Skip to main content

Is passage.io a Scam? Security Check Results - Passage Reviews

passage.io favicon

Is passage.io Safe? Security Analysis for Passage

Check if passage.io is a scam or legitimate. Free security scan and reviews.

TechnologyN/asmall
WebflowGoogle FontsSwiper.jsYouTube embedsMemberStack (for login and membership management)
Analyzed 9/5/2025Completed 8:17:54 PM
64
Security Score
MEDIUM RISK

AI Summary

Passage is a technology company specializing in immersive virtual experiences for experiential events. Their platform enables users to create and participate in virtual events with high-quality 3D environments powered by Unreal Engine, accessible instantly via web browsers without downloads or apps. The company targets event organizers, agencies, brands, educators, and communities seeking innovative virtual event solutions. Passage positions itself as a cutting-edge provider integrating Web3 features such as NFT utility and token gating, enhancing engagement and monetization opportunities. Technically, the website is built on Webflow with modern front-end technologies including Swiper.js for interactive sliders and MemberStack for user authentication. The site is well-optimized for performance, mobile responsiveness, and accessibility, featuring rich multimedia content such as embedded videos and social feeds. The platform leverages external services like YouTube and Mailchimp for content delivery and marketing. From a security perspective, the site enforces HTTPS and uses secure login mechanisms but lacks explicit security headers and published incident response or vulnerability disclosure policies. Privacy compliance is partially addressed with visible privacy and terms of service pages, though cookie consent mechanisms are absent. WHOIS data is privacy-protected, which is typical for startups, and no suspicious indicators were found. Overall, Passage demonstrates a strong digital presence with professional design and content quality, a solid technical foundation, and a good security posture. Strategic improvements in security policy transparency and privacy compliance would enhance trust and regulatory alignment.

Detected Technologies

WebflowGoogle FontsSwiper.jsYouTube embedsMemberStack (for login and membership management)

🧠AI Business Intelligence

Technology stack, business insights, and market analysis powered by AI.

Business Intelligence

Market & Strategic Analysis

Passage operates in the virtual events technology sector, offering a SaaS platform that enables immersive, browser-based experiential events. Their competitive advantage lies in delivering high-fidelity 3D environments with no app downloads, leveraging Unreal Engine graphics and spatial audio/video. The inclusion of Web3 capabilities positions them well for emerging markets involving NFTs and token gating. Revenue likely derives from platform subscriptions, marketplace transactions, and enterprise partnerships. The company targets a diverse customer base including entertainment, education, conferences, and community engagement sectors. Partnerships with recognized entities like MIT and Capitol Records enhance credibility. The company actively engages audiences via podcasts, blogs, and social media, indicating a growth-oriented marketing strategy. The beta program suggests ongoing product development and user feedback integration.

Security Posture Analysis

Comprehensive Security Assessment

The website exhibits a mature security posture with HTTPS enforced and secure user authentication via MemberStack. No sensitive data exposure or vulnerable libraries were detected in the front-end code. However, the absence of key security headers such as Content Security Policy (CSP), HTTP Strict Transport Security (HSTS), and X-Frame-Options reduces defense-in-depth. There is no publicly available incident response contact or vulnerability disclosure policy, which limits transparency and preparedness for security incidents. Privacy policies are present and appear GDPR compliant, but cookie consent mechanisms are missing, which may pose compliance risks. Overall, the security posture is good but could be improved by implementing additional HTTP security headers, publishing security policies, and enhancing privacy compliance mechanisms.

Strategic Recommendations

Priority Actions for Security Improvement

1

Implement and enforce security headers including CSP, HSTS, and X-Frame-Options to strengthen browser security.

Observations

AI-powered comprehensive website and business analysis.

AI-Enhanced Website Analysis

Business Insights

Company:

Passage

Description:

Passage offers world-class virtual experiences for experiential events. No apps. No downloads. No compromises.

Key Services:
Virtual experiential events platformImmersive 3D environmentsPlug-and-play integrationCreator tools for custom worldsWeb3 features including NFT utility and token gating
Content Quality:

excellent

Branding:

consistent

Technical Stack

Technologies:
WebflowGoogle FontsSwiper.jsYouTube embedsMemberStack (for login and membership management)
Platforms:
Browser-basedYouTubeDiscord
Performance:

fast

Mobile:

excellent

Accessibility:

good

SEO:

good

Security Assessment

Security Score:
85/100
Best Practices:
  • HTTPS enforced
  • Secure login forms with MemberStack
  • No exposed sensitive data in HTML

Analytics & Tracking

Tracking Level:minimal
Privacy Compliance:basic

Advertising & Marketing

Marketing Tools:
Mailchimp (via list-manage.com)
Transparency Level:basic

Website Quality Assessment

Design Quality:excellent
User Experience:excellent
Content Relevance:excellent
Navigation Clarity:excellent
Professionalism:excellent
Trustworthiness:high

Key Observations

1

Website is fully accessible with rich multimedia content.

🛡️Security Headers

HTTP security headers analysis and recommendations.

Security Headers

HTTP security headers analysis

30/100
Score

Missing X-Frame-Options header

HIGH

Prevents clickjacking attacks

Missing X-Content-Type-Options header

MEDIUM

Prevents MIME type sniffing

Missing Content-Security-Policy header

HIGH

Controls resources the browser is allowed to load

Missing X-XSS-Protection header

MEDIUM

Legacy XSS protection (deprecated but still recommended)

Missing Referrer-Policy header

LOW

Controls referrer information sent with requests

Missing Permissions-Policy header

MEDIUM

Controls browser features and APIs

Sensitive data may be cached

LOW

Cache-Control header should include "no-store" for sensitive pages

👤GDPR Compliance

Privacy and data protection assessment under GDPR regulations.

GDPR Compliance

Privacy and data protection assessment

53/100
Score

No Cookie Policy found

HIGH

GDPR requires clear information about cookie usage

No Cookie Consent Banner found

HIGH

GDPR requires explicit consent for non-essential cookies

No Data Protection Officer mentioned

LOW

Large organizations may need to designate a DPO under GDPR

Privacy policy may not be GDPR compliant

MEDIUM

Privacy policy lacks explicit GDPR compliance elements

GDPR Compliance Analysis

Privacy Policy85% confidence
Cookie Policy0% confidence
Contact Information Found90% confidence
phone

🛡️NIS2 Compliance

Network & Information Security Directive compliance assessment.

NIS2 Compliance

Network & Information Security Directive

2/100
Score

No information security framework found

HIGH

NIS2 requires documented cybersecurity and information security measures

No vulnerability disclosure policy

MEDIUM

NIS2 encourages coordinated vulnerability disclosure

No security policy documentation found

HIGH

NIS2 requires documented cybersecurity governance and risk management

No incident response procedures found

HIGH

NIS2 requires documented incident response and business continuity plans

No business continuity planning found

MEDIUM

NIS2 emphasizes operational resilience and business continuity

No security contact information

HIGH

NIS2 requires clear incident reporting channels

No vulnerability reporting mechanism

MEDIUM

Clear vulnerability reporting supports coordinated disclosure

No NIS2 reference found

LOW

Consider explicitly mentioning NIS2 compliance efforts

Critical sector without clear security compliance

HIGH

Detected sectors: transport, digital

📧Email Security

SPF, DKIM, and DMARC validation and email security assessment.

Email Security

SPF, DKIM, and DMARC validation

85/100
Score

No BIMI Record

LOW

BIMI displays brand logos in email clients

No MTA-STS Policy

MEDIUM

MTA-STS enforces TLS for email delivery

No TLS-RPT Record

LOW

TLS-RPT provides reporting for email TLS issues

SPF
Sender Policy Framework
DKIM
DomainKeys Identified Mail
DMARC
Domain-based Message Authentication
MX Records
Mail Exchange Records
BIMI
Brand Indicators
MTA-STS
Mail Transfer Agent Security
TLS-RPT
TLS Reporting
DNSSEC
DNS Security
SPF Details
Record:
v=spf1 include:servers.mcsv.net include:dc-aa8e722993._spfm.passage.io -all
DNS Lookups:2/10
Policy:-all
DKIM Selectors Found
Selector:k2(1416-bit rsa)
DMARC Details
Policy:quarantine
Aggregate Reports:your-email@domain.com
Forensic Reports:your-email@domain.com

🏆SSL/TLS Security

Certificate validity and encryption analysis.

SSL/TLS Security

Certificate validity and encryption analysis

75/100
Score

SSL Certificate Expires Within 90 Days

MEDIUM

SSL certificate expires in 60 days

Weak SSL Key Length

HIGH

SSL certificate uses 256-bit key, which is considered weak

Partial SSL/TLS Assessment

LOW

Completed 2 of 4 security checks due to time constraints

Certificate Details

Subject:www.passage.io
Issuer:WE1
Valid Until:11/5/2025 (60 days)
SANs:www.passage.io

OCSP Status

OCSP Stapling Disabled

📊DNS Health

DNS configuration and security assessment.

DNS Health

DNS configuration and security assessment

85/100
Score

DNSSEC Not Enabled

MEDIUM

DNSSEC is not configured for this domain

CAA Records Not Configured

LOW

Certificate Authority Authorization (CAA) records not found

DNS Records

A Records:198.202.211.1
Name Servers:
ns19.domaincontrol.comDNS only
ns20.domaincontrol.comDNS only
MX Records:
1: aspmx.l.google.com
5: alt1.aspmx.l.google.com
5: alt2.aspmx.l.google.com
10: alt3.aspmx.l.google.com
10: alt4.aspmx.l.google.com
SOA:Serial: 2025082604, TTL: 600s

DNSSEC Status

DNSSEC Not Enabled

DNS Performance

Resolution Time:80ms

SPF Analysis

SPF Record:
v=spf1 include:servers.mcsv.net include:dc-aa8e722993._spfm.passage.io -all

Network Security

Port scanning and network exposure analysis.

Network Security

Port scanning and network exposure analysis

100/100
Score

Good Network Security Posture

LOW

No unnecessary services detected on common risky ports

🔧Technical Analysis

Detailed technical findings and analysis from AI assessment.

Technical Analysis

Comprehensive security assessment findings

Additional Findings

The website is built using Webflow CMS, leveraging modern front-end libraries such as Swiper.js for interactive sliders and Google Fonts for typography. It integrates third-party services including YouTube for video content and MemberStack for membership and login management. The site is hosted on Webflow's infrastructure, ensuring fast loading times and global CDN distribution. The design is mobile-optimized with responsive layouts and accessibility considerations. The use of embedded videos and social media feeds enhances user engagement. There is no evidence of legacy or vulnerable libraries. The technical implementation is modern and well-executed, supporting a high-quality user experience and scalable platform operations.
Analyze Another Website